December 2003 - cypherpunks-legacy

transaction costs in anonymous markets
by Wei Dai 17 Dec '03

17 Dec '03

Some people have predicted (advocated?) frictionless capitalism, which will be brought about by the use of digital technology to reduce transaction costs. However, in anonymous markets these costs may be quite high. Two main components of transaction cost in an anonymous market will be the cost to maintain anonymity and the cost to evaluate reputations. Maintaining anonymity requires that communications be done through special untraceable protocols. The current state-of-art (i.e. RemailerNet) adds several hours of transmition time to each message to achieve effective untraceability. Contract negotiation, for example, becomes very difficult under these circumstances. Untraceable communications also use up more computing and communications resources. Although remailers don't yet charge any money to pass along messages, this is sure to change in the future. Unless the structure of the Internet is completely redesigned, untraceable messages will always cost more than traceable ones, although I hope this cost difference can be reduced through technical advances. The second big part of transaction cost in an anonymous market is reputation evaluation. Of course, normal, everyday transactions require reputations to be evaluated. However, more effort and cost will be expanded on these evaluations in an anonymous market because the effects of misevaluations will be much more damaging. Reputations must be constantly reevaluated, as pseodonyms are easily transfered. Since no good theories of reputation currently exist, these evaluations are difficult to automate. Perhaps theoretical advances can make these evaluations easier and/or more accurate. However there does not appear to be any major research effort in this area. If these costs remain high, but anonymous markets develop regardless, it will be interesting to see how these costs affect the structure of the markets. Will special protocols for contract negotiations develop to minimize the number of round-trip messages? Will each market be dominated by a few big entities because people can't keep track of reputations of many smaller players? But then how will these big entities be organized? Wei Dai

3 2

My chat with Goeff Greiveldinger
by Michael Froomkin 17 Dec '03

17 Dec '03

I will be appearing with Goeff Greiveldinger, he of the Justice Dept, at a discussion of commercial key escrow next Thursday in Bethesda. Anyone with fun questions I should throw at him should contact me... Please note that the ostensible topic of this discussion is *commerical* key escrow, not Clipper per se, so I have to be diplomatic.... A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | New address, but it's still just as hot here.

5 7

Re: Netscape question transformed
by Mark Neely 17 Dec '03

17 Dec '03

Alice de 'nonymous wrote.. >> What would you >> rather see? A company makes a beta release for people to attempt to >> break, fixes the bugs, and then releases a better product? Or would >> you rather see a company release a product, tell people it is secure, >> and then get bitten by numerous holes in it? > >Well, I'm not sure that I'd want to make any representations or imply any >warranties whatsoever. Ahhh.... this sort of thinking really lets the user down. The reason Netscape (et. al) has market capitalisation is because they sell their product to us, the users. It is a bit of a worry if software authors can write and then release for sale "buggy" software, and hide safetly behind "I make no warranties etc." To adopt an analogy... would you be happy to buy a car from Toyota (or whoever) if they were allowed to hide behind a warranty disclaiming liability should it break down (or blow up)? Somewhere along the lines, those who make their money selling software should have to be responsible for bugs. Thoughts? Mark Neely ___ Mark Neely - accessnt(a)ozemail.com.au Lawyer, Professional Cynic Author: Australian Beginner's Guide to the Internet Work-in-Progress: Australian Business Guide to the Internet WWW: http://www.ozemail.com.au/~accessnt

1 0

Re: Weekly MixMaster list
by Daniel Miskell 17 Dec '03

17 Dec '03

What is the MixMaster list, and what is it for? Apologies on my newbie status. Munster --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________ re reported. You don't need a strong authentication technique >if a stolen card is easy to cancel. The card's easy to cancel, but the cash ain't. Credit cards are cleared with the issuer. Digital cash with smart cards acting as transaction observers don't need this. The thief need only transfer the cash from the stolen card to his own, just like he does with regular cash. >Even with a weak PIN system for authentication, you can always provide >a "duress" PIN, right? Sounds like a better choice.

1 0

called as juror (fwd)
by rosaphil 17 Dec '03

17 Dec '03

(Better Living Thru Better Living) *************************************************************************** * SNAIL ME + GABRIELLI'S *ZINFANDEL* (RED) & * * YER ROSEHIPS + * * IF YOU LIKED THIS POST! + *ASCENZA* (WHITE-BLEND)---YUMMY! * *************************************************************************** [Ask Fer *Gabrielli Wine* at yer local liquor store if'n ya want to tend yer rugosa] Let your voice be heard in the campaign to save the life of Mumia Abu Jamal ++++ stop de execution of Mumia Abu-Jamal ++++ ++++ if you agree copy these 3 sentences in your own sig ++++ ++++ more info: http://www.xs4all.nl/tank/spg-l/sigaction.htm ++++ ---------- Forwarded message ---------- Date: Sun, 3 Sep 95 17:50 EST From: lindat(a)iquest.net To: news(a)aen.org Subject: called as juror From: landers(a)AZStarNet.com (L. A. ANDERSON) IF YOU'RE CALLED FOR JURY SERVICE Don't worry! Be happy! Look at jury service as an opportunity to "do good" for yourself and others. It's your chance to help the justice system deliver justice, which is absolutely essential to a free society. Also, you can do more "political good" as a juror than in practically any other way as a citizen: your vote on the verdict is also a measure of public opinion on the law itself--an opinion which our lawmakers are likely to take seriously. Short of being elected to office yourself, you may never otherwise have a more powerful impact on the rules we live by than you will as a trial juror. However, unless you are fully informed of your powers as a juror, you may be manipulated by the less powerful players in the courtroom into delivering the verdict they want, instead of what justice would require. That is why this "kit" was written--to give you information that you're not likely to receive from the attorneys, or even from the judge. _ Justice may depend upon your being chosen to serve, so here are some "words to the wise" about how to make it through voir dire, the jury selection process: You may feel that answering some of the questions asked of you would compromise your right to privacy. If you refuse to answer them, it will probably cost you your chance to serve. Likewise, if you "talk too much"--especially if you admit to knowing your rights and powers as a juror, as explained below, or that you have qualms about the law itself in the case at hand, or reveal that you're bright, educated, or are interested in serving! So, from voir dire to verdict, let your conscience be your guide. _ Nothing in the U.S. Constitution or in any Supreme Court decision requires jurors to take an oath to follow the law as the judge explains it or, for that matter, authorizes the judge to "instruct" the jury at all. Judges provide their interpretation of the law, but you may also do your own thinking. Keep in mind that no juror's oath is enforceable, and that you may regard all "instructions" as advice. _ Understanding the full context in which an illegal act was committed is essential to deciding whether the defendant acted rightly or wrongly. Strict application of the law may produce a guilty verdict, but what about justice? If the jurors agree that, beyond a reasonable doubt, the accused did act as charged, then "context becomes everything" in reaching a verdict you can live with. Credit or blame for the verdict will go to you, so be sure to ask the judge how you can pose questions to witnesses, so that you can learn the complete context, should the lawyers fail to bring it out. _ When they believe justice requires it, jurors can refuse to apply the law. Jurors have the power to consider whether the law itself is wrong (including whether it is "unconstitutional"), or is being applied for political reasons. Is the defendant being singled out as "an example" in order to demonstrate government muscle? Were the defendant's constitutional rights violated during the arrest? Much of today's "crime wave" consists of victimless crimes--crimes against the state, or "political crimes", so if you feel that a verdict of guilty would give the government too much power, or help keep a bad law alive, just remember that you can refuse to apply any law that violates your conscience. _ Prosecutors often "multiply charges" so the jury will assume the defendant "must be guilty of something". But one of the great mistakes a jury can make is to betray both truth and conscience by compromising. If you believe the defendant is not guilty of anything, then vote "not guilty" on all counts. _ You can't be punished for voting according to your conscience. Judges (and other jurors) often pressure hold-out jurors into abandoning their true feelings and voting with the majority "...to avoid the expense of a hung jury and mistrial". But you don't have to give in. Why? Because... _ Hung juries are "OKAY". If voting your conscience should lead to a hung jury, not to worry, you're doing the responsible thing. There is no requirement that you must reach a verdict. And the jury you hang may be significant as one of a series of hung juries sending messages to the legislature that the law you're working with has problems, and it's time for a change. If you want to reach consensus, however, one possible way is to remind your fellow jurors that... _ Jurors have the power to reduce charges against the defendant, provided that "lesser included offenses" exist in law (ask the judge to list and explain them, and the range of potential punishments that go with each). Finding guilt at a lower level than charged can be appropriate in cases where the defendant has indeed victimized someone, but not so seriously as the original charges would indicate. And, if it will be up to the judge to decide the sentence, it's within the power of the jury to find the defendant guilty of a reduced charge which will, at most, entail the amount of punishment it thinks is appropriate. _ The Fully Informed Jury Association (FIJA) hopes the above information helps you to find a verdict that you believe is conscientious and just, a verdict which you can therefore be proud to discuss with friends, family, legal professionals, the community or the media, should any of them want to know what happened, how, and why. If you have further questions, or want a hard copy of this article and others contained in FIJA's "Jury Power Information Kit", phone 1-800-TEL-JURY, and leave your name and address on tape. The office phone number for FIJA National HQ is 406-793-5550.

1 0

MUZ_zle
by John Young 17 Dec '03

17 Dec '03

10-16-95. NYPaper: "The New Watchdogs of Digital Commerce." Think of them as a truth squad of cyberspace, these crusading graduate-student hackers from Berkeley. "This is a tradition of unfettered inquiry and curiosity," said John Gilmore, "for hackers, nothing is sacred and everything is subject to verification before you can really believe it." "The hacker ethic is transferring some of its better lessons to the world of commerce," said Steven Levy, "we're groping for a way to use the Net in a way where information will flow freely and people can still make money. The hackers are going to help us find ways to have a more humanized system of commerce." "Will Netscape be the next Microsoft, or the next victim of Microsoft?" Some investors believe Netscape could become "the next Microsoft." Other people believe that Netscape could become the next Microsoft victim, and that the next Microsoft is none other than Microsoft itself. All these new features of Navigator 2.0 send a clear notice to the industry that Netscape has no interest in bowing to the traditional Internet procedures for setting software standards by academic and scientific committee. The Internet has become primarily a commercial medium, where standards are set by whoever has the highest market share. It is a concept Microsoft knows well, and one that Netscape has grasped. MUZ_zle (16 kb)

1 0

Re: Netscape rewards are an insult
by daw＠lagos.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9510141153.AA16412(a)all.net>, Dr. Frederick B. Cohen <fc(a)all.net> wrote: > The idea that Netscape (like Microsoft) thinks they can get free > testing services from all over the net by real experts just by offerring > a tee shirt is down right offensive. But (amusingly enough) they can get free testing services from this aspiring student for free just by providing source code. Hey, it's fun! :-) I'm no expert, but you get what you pay for. <grin> [Psst: anyone wanna offer source code to the security modules?] I do think their ``bug bounty'' system is an improvement -- at least they're showing some concern for security, and beginning to admit that outside review of security-critical code is...well...critical. Still, I do agree that they really oughta be employing true experts to carefully evaluate their system, if they wanna claim anything about its security. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMIGMAyoZzwIn1bdtAQG98wF9Hr8lU8nXqP50MNwO2SNhsMUg5XhzfcWg 22Tsp8OkYV3F22gUcI6Un1w7peK7ciT5 =hs1A -----END PGP SIGNATURE-----

2 1

Re: My chat with Goeff Greiveldinger
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510152027.NAA23085(a)mycroft.rand.org>, jim(a)acm.org (Jim Gillogly) wrote: > You might try addressing the areas of liability for escrow agents. If > private escrow agents can be sued for loss of information due to theft > or other authorized or unauthorized release of keys, their liability could > be horrendous, depending on the value of the compromised data. The problem of liability should be managable. There are commercial data storage firms (microfilm, etc.) that not only have access to the key for your data, but to the data itself. Still, liability lawsuits have not driven them out of business. I therefore belive that liability issues will not pose a significant obstacle to commercial key escrow. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMIGMiCoZzwIn1bdtAQHiJQGAlFhXEVKkf329xCbpWHHXYRkMNJUpbdDZ nrEKcYvu9SVt/wlPLSq97sWukyQPxth0 =c5Wl -----END PGP SIGNATURE-----

1 0

Re: Yes, indeed the PA law is for real!
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>PA Senate Bill 655 was signed into law on June 13, 1995, and it does >appear to make non-logged anonymous remailers illegal. This is rich! The PA legislature just set themselves up for an anonymous e-mail shit-storm from people using *foriegn* non-logging remailers to prove their point. Hold on to your shorts, you guys at hacktic, et. al., you're gonna have some fun now... Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Netscape rewards are an insult
by John Young 17 Dec '03

17 Dec '03

All praise to Jeff and his fellow programmers for sharing the struggle to come up with stronger cypto, but, no praise at all to Netscape's front office guys bullshitting the stock holders and speculators. Check the press releases and the speeches to customers and investors. Scott McNealy shocked an audience into silence at a recent plush meeting of high-tech reps with investors by asking, "Anybody telling the truth here?" Then applause broke out for his shrewd beat-em-to-the-punch candor to offset the pervasive cynicism of oft-burned high-tech investors. Big bucks are not made by hard-working programmers but by the marketeers of NASDAQ and NYSE smoke and mirrors used to lure multitudes of unsavvy investors and Internet merchandisers. Netscape's leaders are protecting its major stockholding coldhearts, just like Microsoft, Intel, Motorola, AT&T, and the rest do, or they die in the financial fuck-the- public sharkpool. They couldn't care less about the bottom- of-the-ladder techies who do the grunge work, take the blame for programming mistakes produced under horrendous marketing deadlines, and then are left to commiserate with each other and gnaw knuckles. That's the joy and sorrow of this reading list, the ancient story, talented people working their asses off for sons of bitches who think employees are contemptible, disposable or bribeable for cheap change and backpats -- and easily replaceable on shore or off. Jeff's not alone in this bind.

3 2

Netscape bugs bounty
by & E. Metzger 17 Dec '03

17 Dec '03

I am among the first people to be sarcastic about things Netscape has done (I believe I originated the joke about the extra money from the Netscape IPO being used to build a structure large enough to house Marc Andreessen's ego), but I think this sniping about the Bugs Bounty is silly. They are finally starting to try to do the right thing and take problems, especially security problems, with their software seriously and not sweep them under the rug. Cut them some slack. It might not be perfect, but they are moving in a good direction. Perry

1 0

Re: The NSA Visits Compendium
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:05 PM 10/16/95 -0700, Vladimir Z. Nuri wrote: >a study on this would be very significant. (from what I understand, the NSA >tried to do this with public key crypto, i.e. suppress it at the >publication stage. a professor gave a lecture on this in one of my >classes and said that it was even covered in the NYT at the time. >unfortunately I lost the date. I believe it was a long time ago >(maybe the 80's or even the 70's). hopefully someone else has an >encyclopedic brain. 1977/1978. "A Proposal for a Public Key Encryption System." IEEE meeting. Imprisonment threat by letter. Mathematical Games column in Scientific American. 3,000 copies of paper distributed free by MIT. >unfortunately, whenever someone says, "don't name my company", it loses >effectiveness. I would like to point out that people are directly contributing >to their erosion of rights by this behavior that suggests that they >doing something lawbreaking that they are ashamed of. One should always suggest to investigating authorities that they show a warrant or get lost. "Quo warranto"? It is rarely useful to chat with them. DCF

1 0

JOin List request - help please
by John Leishman 17 Dec '03

17 Dec '03

Have tried on MANY occassions to join your list. The resultsd are commonly, in varitions of; Date: Tue, 12 Sep 95 15:44:37 PDT To: jleishma(a)ozemail.com.au From: Majordomo(a)toad.com Subject: Your Majordomo request results: Re: Your Majordomo request results: Reply-To: Majordomo(a)toad.com -- Your request of Majordomo was: >>>> subscribe Cypherpunks **** subscribe: unknown list 'Cypherpunks'. Please please, could I be joined <sob> <g> --------------------------------------------------- >>--> -*-_|\ John Leishman in Tropical Darwin / \ Wk (61) (089) 81 8155 Hm (61 (089) 81 9697 \_.--._/ Mobile (61) 018 089 631 Fax (61)(089) 819415 v E-Mail jleishma(a)ozemail.com.au 100026.157@compuserve

1 0

Re: what are these people selling????
by Rich Salz 17 Dec '03

17 Dec '03

>Jim Bidzos and some of us might have interesting interactions on >patent issues, but I've got to emphasize that he's no demon. He's a >guy trying to make a buck on his patent properties -- by and large he >has the same interests about seeing cryptography spread that the rest >of us do. Only until the patents expire. He's no demon, but there's no altruism at work. Come the millenium he moves to things like selling cars. You heard it here first. /r$

1 0

Re: My chat with Goeff Greiveldinger
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:00 PM 10/15/95, Michael Froomkin wrote: >I will be appearing with Goeff Greiveldinger, he of the Justice Dept, at >a discussion of commercial key escrow next Thursday in Bethesda. Anyone >with fun questions I should throw at him should contact me... > >Please note that the ostensible topic of this discussion is *commerical* >key escrow, not Clipper per se, so I have to be diplomatic.... The question I have is this: Why is the Justice Department even involved at all if it is truly only about _commercial_ key escrow? (I have some speculations, of course, which I'll share in a minute.) While commercial key escrow of course has legal implications, so do a lot of things that I suspect the Justice Department has no interest in discussing with anyone. And most of the implications of commercial key escrow--if strongly voluntary in the sense we have discussed many times here--are implications of _contract_ law that will get hashed out through court cases. So, why is the JD interested? Why would Mr. Greiveldinger of the JD be at a discussion of commercial key escrow if in fact it is to be purely voluntary and strongly voluntary? Unless, of course, the JD has interests that go beyond mere privately arranged contracts to hold keys in safety. Or, I suppose, export control issues. (But then I think it unlikely that a strongly voluntary system would be allowed to be exported. And since a domestic version that is strongly voluntary would leak out almost immediately, I think a domestic strongly voluntary CKE system is unlikely.) I suspect Michael Froomkin can tell us why the JD is involved, what the stated reason is, but I still find it "odd" that a purely voluntary contractual arrangement between, say, "Thomas Paine" and "Ye Olde Keye Repository" is generating interest by King George's legal officers. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

4 3

Undeliverable Message
by MAILER-DAEMON＠usmc.mil 17 Dec '03

17 Dec '03

To: <cypherpunks(a)toad.com> Cc: <remailer-operators(a)c2.org> Subject: Re: PA Remailer Concerns Message not delivered to recipients below. Press F1 for help with VNM error codes. VNM3043: CPL JASON P JONES@IRM711@MCLB Albany VNM3043 -- MAILBOX IS FULL. The message cannot be delivered because the recipient's mailbox contains the maximum number of messages, as set by the system administrator. The recipient must delete some messages before any other messages can be delivered. The default limit is 1000 messages. Administrators can set lower limits if required using the Change mailbox settings function available in the Manage User menu (MUSER). The 1000 message limit is the maximum allowed by the Mail program. If this limit is reached, the recipient must delete some of the messages before the mailbox can accept any more incoming messages. ---------------------- Original Message Follows ----------------------[I'm sending this to the cypherpunks and remailer-operators lists. Replies are directed to c'punks, just to avoid crossposting followups, but I read both lists. -Futplex] Mark writes: [re: a new Pennsylvania law] > More likely the law will be used when a remailer operator wont play ball with > the local LEA and surrender any existing logs. Then the LEA can simply throw > the operator into a court under this legislation. > > If (when?) something serious is perpetrated and planned using a remailer then > they will have the motivation to shut them down. I would very much like to see this law tested. I think it could prove fairly important to attack it with a well-planned, benign test case rather than wait for the next National Liberation spam or a death threat. I don't live in PA, but I would be willing to participate as the defendant in a test case under the right circumstances. Presumably I would open an account with an ISP in Penna., set up a remailer on the account (need to find an ISP that clearly allows that), and have somebody send a message through it. We would need to design a promising test case and find an attorney willing & able to offer pro bono services. Any comments or suggestions, esp. from legal types (who of course are not offering formal legal advice to anyone :) ? Is this realistic ? What would it take to elicit a prosecution for such a test case ? -Futplex <futplex(a)pseudonym.com>

1 0

Illegally canceled articles on Microsoft Security Bugs
by anonymous＠replay.com 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.security, comp.os.ms-windows.apps.misc,comp.os.ms-windows.win95.misc,alt.religion.scientology,news.admin.net-abuse.misc,comp.protocols.smb,comp.os.ms-windows.advicacy,comp.os.ms-windows.networking.tcp-ip) -----BEGIN PGP SIGNED MESSAGE----- Could somebody please tell me who illegally canceled my article <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu>, referenced in the followup article below, as well as several other articles I posted this morning? It was cross-posted to several groups, but I don't think it should have triggered any spam-cancelers, and I see nothing in news.admin.net-abuse.misc. I'd find the cuplrit myself, but Stanford only saves the last 100 or so messages in control. See the rather prominent blinking link on the Web page below for the other PGP-signed article that was canceled. Thanks in advance. Followups set to news.admin.net-abuse.misc. Don't bother canceling this article, my friend. By the way, the other articles were saved and emailed as well. - -rich jabba(a)deathstar.stanford.edu and other accounts moderator of a certain list http://rescomp.stanford.edu/~llurch/innocuous/faq.html PGP key available on MIT server and via finger -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIHC9oND7LjhcPQ9AQHTZgQAxGQZGTFDrzUTfyWCuLTUP2VbIp6IwK/Y NJjy7ke4rgZH+bjegb1h2ig/lALEhnX4+uhurhDJ0wq6du2p5V/DUlsNHCcWvotL GHyd/ZLzXGq6OYRoPijUHAdDBPD2wWIdAfsYNiTgv3iezBJL+2cCq/YLiPd22KyF MROQwF05Hoc= =1K2B -----END PGP SIGNATURE----- I will be charitable and assume that it was someone else I've pissed off (lord knows there's several), and not someone working directly for Microsoft or the Church [spit] of Scientology, who were both maligned in the canceled posts. In article <petrichDGID4I.5GG(a)netcom.com>, petrich(a)netcom.com (Loren Petrich) wrote: > Newsgroups: > alt.security,comp.os.ms-windows.apps.misc,comp.os.ms-windows.win95.misc > Path: > nntp.Stanford.EDU!news.Stanford.EDU!agate!howland.reston.ans.net!newsfeed.internetmci.com!news.sprintlink.net!noc.netcom.net!netcom.com!petrich > From: petrich(a)netcom.com (Loren Petrich) > Subject: Re: More Microsoft Security Bugs > Message-ID: <petrichDGID4I.5GG(a)netcom.com> > Organization: NETCOM On-line Communication Services (408 261-4700 guest) > References: <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu> > Date: Sun, 15 Oct 1995 21:02:42 GMT > X-Original-Newsgroups: > comp.os.ms-windows.win95.misc,alt.security,comp.os.ms-windows.apps.financial,comp.os.ms-windows.apps.utilities,comp.os.ms-windows.apps.word-proc,comp.os.ms-windows.apps.misc,alt.fan.bill-gates,comp.os.ms-windows.advocacy,alt.destroy.microsoft,comp.os.ms-windows.nt.admin.misc > Lines: 9 > Sender: petrich(a)netcom2.netcom.com > Xref: nntp.Stanford.EDU alt.security:21764 > comp.os.ms-windows.apps.misc:13757 comp.os.ms-windows.win95.misc:38436 > My favorite example of such a bug is in BOB's password protection. > If you mistype it 3 times, it will ask if you want another one. The only > defender of this "feature" has been -- get this -- JoanieDearest (at > least if memory serves me correctly). > -- > Loren Petrich Happiness is a fast Macintosh > petrich(a)netcom.com And a fast train > Visit my ftp site; its address is (in WWW syntax): > ftp://ftp.netcom.com/pub/pe/petrich

2 1

Next EFF-Austin General Meeting : Cryptography (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Japan-CIA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Japan-CIA Tokyo (AP) -- Japan said that its relations with Washington could be seriously damaged if a report that the CIA spied on Japanese representatives at auto talks proves true. The New York Times reported Sunday that the CIA eavesdropped on conversations between Japanese negotiators and automakers during the talks in Geneva this year, reporting the results daily to U.S. Trade Representative Mickey Kantor. According to the report, Kantor was provided with summaries of conversations between Japanese bureaucrats and executives from Toyota Motor Corp. and Nissan Motor Co. Toyota called the alleged eavesdropping ``unthinkable,'' but refused to comment further.

1 0

Re: PA Remailer Concerns
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:13 AM 10/16/95, Futplex wrote: >I would very much like to see this law tested. I think it could prove fairly >important to attack it with a well-planned, benign test case rather than wait >for the next National Liberation spam or a death threat. > >I don't live in PA, but I would be willing to participate as the defendant in >a test case under the right circumstances. Presumably I would open an >account with an ISP in Penna., set up a remailer on the account (need to find >an ISP that clearly allows that), and have somebody send a message through it. > >We would need to design a promising test case and find an attorney willing & >able to offer pro bono services. I'm not a lawyer, though I hang out on the "Cyberia" list and I watched a lot of the OJ trial. :-} Seriously, it is hard to "design a promising test case" in this way. They--the Pennsylvania law enforcement authorities--don't have to take the bait. They can just do nothing, until an incident arises which provokes them. Maybe next year, maybe five years from now. Such an incident is likely to be one that they figure will make for a popular prosecution. One of the Four Horseman, probably. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

5 4

Re: Netscape question transformed
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 13 Oct 1995, Derek Atkins wrote: > > Why would a compony like Netscape jeapordise themselves by > > even letting out a beta version so hackers have time to find bugs > > before the full version is released. Don't take me wrong I have only > > been on the net fer a little over a year and Love Netscape. And If I > > knew what I was Doing I would love to help them..... > > I don't think that this can jeopardize a company... I agree. I don't think it can jeopardize the company either. After all, we're talking about a company that has a market capitalization of more than TWO BILLION US DOLLARS. Two Billion Dollars can buy a lot of talent. Even if Netscape has to spend $100 Million on this problem, that sum represents only 5% of Netscape's total market capitalization. I'm certain that Netscape has established a crisis control centre which is manned and readied. That a proper spin control program has been implemented, and that a reasonable firm like Skadden Arps has been retained. And I'm confident, that Netscape is drawing not only on its own resources but that it's drawing on those who share Netscape's interests. Even if Skadden doesn't let you past security without a seven figure retainer, I'm sure that if one of those nice boys from Morgan Stanley, ... someone with snazzy Princeton ties ... maybe one of the ones who orchestrated the Netscape IPO calls over to Skadden, Arps, Slate, Meagher & Flom, I'm sure that one of those fellows will have their call returned by any partner at Skadden. They're professional that way. > What would you > rather see? A company makes a beta release for people to attempt to > break, fixes the bugs, and then releases a better product? Or would > you rather see a company release a product, tell people it is secure, > and then get bitten by numerous holes in it? Well, I'm not sure that I'd want to make any representations or imply any warranties whatsoever. > From a PR perspective, it sounds much better to take the first tact. > Similarly, you will get a better product using the first method. > Using the second method, NOT beta-testing your product, has a greater > chance of jeopardizing a company. At least if they put out a beta, if > the press calls, they can say "this is nor our final product -- we > wanted to let people give it a try and find problems, so that we can > fix them before we start shipping". We aren't just talking about a pre-alpha (Netscape beta) product. We are speaking of something else here. We're talking not only about a problem in their NEW code, we're talking about a very big problem in the middle of their EXISTING code. A huge security hole in the code that everyone is and has been running -- from 850,000 Deutsche Telecom customers, throughout AT&T's internal organization and throughout their worldwide customers, and god only knows how many individuals in the United States and abroad. This is an extremely serious software design issue. It is equivalent to designing and then building a house and forgetting to include any plumbing, and no one really noticing, and no one really saying anything about it. And when someone like Joan Rigdon calls from the Wall Street Journal, I hope that Netscape doesn't try to snow her. She's been up and down the street ... and probably knows all about snow. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

"Corporatocracy"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:42 AM 10/16/95, Michael Froomkin wrote: >Those seeking more info on the conference will find it at: >Http://www.multicorp.com/wec. > >They are asking over $500 in registration fees, which strikes me as wildly >excessive, so I'm not advocating attendence. Excessive registration costs for conferences have long bothered me, as Michael knows first-hand. I just declined to go to the Hacker's Conference this year because the registration has risen to $400 for 2 days. That they supply a midnight buffet is hardly justification for charging $200 a day, in my opinion. (My direct comparison is to science fiction conventions, where the hotel rooms run $70 a day and overall registration--with a nice program book!--is $40 or less.) Doug Barnes informed me that the money laundering conference, for which he wrote those great trip reports, cost $1000 for two days (gulp!). His corporation picked up the tab, natch. It's pretty clear to me that things are getting out of hand. I find myself priced out of most conferences, not because I can't "afford" them, but because I find paying $400 or $600 or more for a short conference to be a poor use of my money, compared to other things (like mortgage payments, books, investments, new doodads for my computer, toys, vacations, etc.). Conferences seem to be priced to take advantage of the tax laws and to soak corporations, which can write off the conferences. (No, I find there is no way I can "write off" the various conferences I'd like to attend.) Needless to say, I'm not saying conference organizers don't have the "right" to charge these exorbitant fees. Clearly they find customers. But it's also my right to avoid these "conference taxes." --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Cardinal Wins Okay for First Online Bank
by Sameer Parekh 17 Dec '03

17 Dec '03

http://www.yahoo.com/headlines/current/business/stories/bankonline_289001.h… -- Sameer Parekh sameer(a)corp.sgi.com

1 0

Bug Bounty [noise]
by Alan Olsen 17 Dec '03

17 Dec '03

Something I noticed about the Netscape Bug Bounty that seems to not have been mentioned here... "Linux users need not apply." (Check the rules as to which versions qualify and see what I mean.) | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

2 1

Forged cancels of posts critical of Microsoft, *apparently* through internetmci.com or nasa.gov
by Richard Charles Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- These are the forged cancels for my articles critical of Microsoft. *Many Thanks* to the person who forwarded them to me; our server expires control way too fast. Somebody did an acceptable forge on the Message-ID, but the Path is quite wrong. Can anybody help me catch this fool? I'm somewhat out of my element here. The most serious posts are available on the Web at http://www-leland.stanford.edu/~llurch/win95netbugs/IP-Security-Bug.txt.asc, and on the gopher archive at gopher://quixote.stanford.edu/1m/win95netbugs. - -rich graves networking systems stanford university llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIH0IIND7LjhcPQ9AQFojQP/UrB/Us1PK8ne1GnsFxqXXVCJpanEKciH p9wqVMfBJOTBdkYBHkuSHkdeaJfXz6QfEQYGZr6HIN/DD8A/VNOSB+dgCbBUYcOj 2/b+x+7CBfGvEsrbIVLxWl/Eua5pIcjWLLmfgYu3dCneDOqrXO9ehZSDg1JD9tTt Av6lQIxTuVM= =V+nf -----END PGP SIGNATURE----- [You always think of something after signing, don't you?] Also emailed to postmaster(a)internetmci.com and postmaster(a)news.msfc.nasa.gov. Was that right? Doesn't microsoft.com get its news feed from internetmci? OK, I'll Cc them, because I know they don't want anyone to believe that this was done by a Microsoft employee. The cancel for <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU>, only, is legitimate, and provides a very good comparison. I'm sure the forger studied it; so should we. Path: rand.org!usc!howland.reston.ans.net!swrinde!elroy.jpl.nasa.gov!sdd.hp.com! hplabs!unix.sri.com!news.Stanford.EDU!not-for-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin g.tcp-ip,comp.protocols.tcp-ip.ibmpc Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 15:55:40 -0700 Organization: Stanford University Lines: 1 Message-ID: <45mqpc$hn(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> was cancelled from within trn. Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo r-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin g.tcp-ip,comp.protocols.tcp-ip.ibmpc Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 15:58:14 -0700 Organization: Stanford University Lines: 1 Message-ID: <45mqu6$iu(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> was cancelled from within trn. Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo r-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: control,comp.protocols.tcp-ip.ibmpc,comp.os.ms-windows.networking.tc p-ip Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 16:00:48 -0700 Organization: Stanford University, CA 94305, USA Lines: 1 Message-ID: <45mr30$kh(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> Path: rand.org!usc!math.ohio-state.edu!uwm.edu!lll-winken.llnl.gov!fnnews.fnal.g ov!unixhub!news.Stanford.EDU!not-for-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.os.ms-windows.win95.setup,comp.os .ms-windows.apps.winsock.mail,comp.os.ms-windows.apps.winsock.misc,comp.os.ms-wi ndows.apps.winsock.news Subject: cmsg cancel <45nvip$ab6(a)nntp.Stanford.EDU> Control: cancel <45nvip$ab6(a)nntp.Stanford.EDU> Date: 14 Oct 1995 02:32:23 -0700 Organization: Stanford University Lines: 1 Message-ID: <45o038$3ip(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <45nvip$ab6(a)nntp.Stanford.EDU> was cancelled from within trn.

1 0